graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2508 commits 1 branch 0 tags 50 MiB
Commit graph

4 commits

Author SHA1 Message Date
Graham McIntire
39e588c686 fix: API token access control, admin form crash, MIB validation, CSP dedup 
- Add organization membership check before API token creation
- Fix admin security allowlist form reading current_user instead of current_scope.user
- Use recursive File.ls instead of Path.wildcard to include hidden files in MIB validation
- Add upload size check before ZIP extraction in MIB controller
- Centralize CSP in SecurityHeaders plug with per-request nonces instead of 'unsafe-inline'
 2026-05-12 09:08:57 -05:00
Graham McIntire
0d961e887f fix: allow Plausible analytics domain in CSP 
Add https://a.w5isp.com to script-src and connect-src so the analytics
script loads and event POSTs are not blocked.
 2026-04-29 14:24:04 -05:00
Graham McIntie
9ecd01dc8f Security hardening: remaining audit fixes 
- Encrypt session cookies (add encryption_salt to endpoint)
- X-Frame-Options: SAMEORIGIN → DENY (match CSP frame-ancestors 'none')
- Remove unsafe-eval from CSP script-src
- Apply security headers in all environments (not just prod)
- Add GraphQL query complexity limit (max 500) via Absinthe.Plug
- GraphQL introspection already blocked in prod via plug

Closes audit items #6, #7, #12, #13, #14, #16
 2026-02-15 12:54:38 -06:00
Graham McIntire
e0552ac97d add security headers 2026-01-29 10:33:24 -06:00